Grant Bourzikas

Learn how to establish a robust Data Loss Prevention (DLP) program. Start by exploring the DLP strategy and maturity model to understand the key components. Then, take the next step and book an appointment for personalized guidance to tailor the program to your specific needs.

3

Stewart & Stevenson has allegedly suffered a 19GB data breach exposing over 3,500 Colombia client contacts, 220,000 orders, 422 internal corporate files, and 36,661 client documents including KYC records.

1

I recently talked with a CISO of a big organization who said something that stuck with me: he's not just measuring MTTR, he's also measuring time to RCA (Root Cause Analysis). It made me think about how much gets buried in MTTR. Detection, investigation, containment, remediation. It all blends into one number, and you lose sight of how long it actually took to investigate. And that's a shame, because there's a lot you can do to optimize that part specifically. When you start paying attention to investigation time, you notice where the hours actually go. The back-and-forth between tools to answer one question. Manually enriching IPs with context that should already be there. Data that's technically there, but not in a shape you can actually use. But if you're measuring time to RCA, it stops being invisible. You start asking: what slowed the investigation down, and more importantly, how do we fix it.

19

I spend a lot of time with manufacturers and product teams who aren’t questioning whether they must comply with the Cyber Resilience Act (CRA) they’re stuck on the how. The CRA is clear on the obligations, but in practice the hard part is interpretation: software distributed online, products that depend on cloud back-ends, continuous updates, open-source components, product families, legacy models… This is exactly what the European Commission is trying to address now. The Commission is preparing a Communication (a guidance document) to explain how the CRA should be applied in real situations and to support a consistent approach across the EU. It’s not a new Regulation and it’s not “binding law” in itself but it matters because it clarifies how key provisions are expected to be understood and implemented in practice. https://lnkd.in/etm43Utx What I like in this draft is that it turns the CRA into practical “rules of the road”, especially on: • Software scope & “placing on the market” (including iterative releases) • What counts as the “product” when hardware depends on apps/drivers/software delivered separately • Open-source (FOSS): when it’s out of scope vs when it becomes a commercial activity, and the steward concept • Updates vs “substantial modifications”: focus on risk/attack surface/intended purpose, not release size • Support period: 5 years is a minimum, and how this works with versioned software/upgrade paths • Cloud / remote processing: what’s part of the product vs general IT infrastructure • Risk assessment & due diligence: manufacturers keep responsibility, including for third-party components The draft is open for feedback for a limited period, and comments are expected in a structured template (so they can consolidate input). If you build products that will fall under CRA, this is a very good moment to stress-test your assumptions and flag the parts that are unclear, unrealistic, or could lead to unintended consequences. I’m sharing the draft guidance here because, from what I see, the companies that will move fastest are the ones that turn these interpretations into concrete internal rules: scope mapping, update governance, support period policy, OSS governance, and evidence-ready documentation.

32

Start treating contracts as part of your compliance infrastructure Compliance teams spent most of last year operating in a regulatory gray zone. AI moved into core business workflows faster than rulemaking could keep up. Expectations still existed. Scrutiny increased. Enforcement risk didn’t wait for the dust to settle. Organizations needed a way to operationalize compliance even when the benchmarks were incomplete. Contracts became the mechanism that filled the gap. Read the full article: https://lnkd.in/g6H-qXCv This piece examines how contracts shifted from risk-allocation tools to active compliance infrastructure. The pattern showed up everywhere in 2025 and is accelerating in 2026. Instead of relying on high-level promises, agreements are starting to encode governance roles, review cycles, monitoring expectations, escalation paths, verification rights, and documentation requirements. In practice, this becomes the evidence trail regulators will expect to see when oversight arrives. The change is quiet but meaningful. Compliance programs still need policies and controls, but the contract is now the part that regulators can inspect externally. It’s the clearest record of what the organization understood its obligations to be at the time it made decisions. It also shows whether the company tied its assurances to real processes or relied on generic language that doesn’t hold up under inquiry. Audit rights are taking on a new role as well. They are no longer back-end enforcement tools. Their presence shapes how vendors govern their systems day to day. They create visibility and accountability even when they aren’t exercised. The same goes for governance language moving into the core agreement instead of the appendix. It’s becoming a primary indicator of compliance maturity. If you work in compliance or partner with your legal team, this matters. Contract language now influences not just commercial outcomes but your ability to demonstrate diligence, readiness, and control. Alignment between contracts and your internal compliance framework is no longer optional. It’s essential to operational credibility. For more insights, see the Contract Trust Report: https://lnkd.in/gJdXkUpJ — Olga V. Mack I build legal systems for real life.

57

17 Comments

Execution governance isn’t new. Access control, IAM, policy engines, and runtime enforcement have existed for decades. What may be shifting is the framing. Instead of treating governance as documentation or post-incident review, what happens if we treat it as a structural execution invariant? Mandate declared. Scope bound. Refusal by default. Allow/deny recorded as a first-class artifact. This is part of an ongoing research effort exploring execution-layer governance models in bounded environments. I’ll share a minimal runtime demonstration of this approach in the coming days.

1

2 Comments